Biometric Recognition: How Do I know Who You...
Transcript of Biometric Recognition: How Do I know Who You...
Anil K. Jain
Dept. of Computer Science and Engineering
Biometric Recognition: How Do I know Who You are? Biometric Recognition:
How Do I know Who You are?
Dept. of Computer Science and Engineering
Michigan State University
http://biometrics.cse.msu.edu
Courtesy: The New Yorker, January 19, 2009
• Should John be granted a visa?
• Does Alice already have a passport?
• Has Robert already voted?
• Is Mary authorized to enter the securefacility?
Identity QuestionsIdentity Questions
• Is Mary authorized to enter the securefacility?
• Can Steve access the secure website?
• Is Cathy the owner of the bank account?
• Does Charlie have a criminal record?
We rely on credentials: documents & secrets
Al-Qaida Gets Fake PapersAl-Qaida Gets Fake Papers
290,000 passports issued by UK were lost/stolen in 2006
Dhiren Barot, the most senior al-Qaida terrorist ever captured in Britain, had 7 passports in his true identity and 2 further passports in fraudulent identities.
http://press.homeoffce.gov.uk/press-releases/passport-warning?version=1
Identity TheftIdentity Theft
Identity thieves steal customer ID & password
to create financial nightmare for customers
• Most common passwords: password, 123456,
Qwerty, abc123, letmein, monkey, myspace1
• Data breach at Heartland Payment Systems exposed
millions of credit cardholders to fraud (Times, Jan 21, 2009)
• NYPD sergeant uses a colleague username & pw to
access terrorist watch-list
Passwords and PINPasswords and PIN
access terrorist watch-list (HSDailyWire.com; 24 Jan, 2009)
• Total identity fraud in the US in 2007 ~ $50 billion
http://www.privacyrights.org/ar/idtheftsurveys.htm#Jav2007
• “As Dow falls, fraud websites rise” USA Today, Jan 29, 2009
7
Automatic method for recognizing humans based on
one or more intrinsic physical or behavioral traits
Biometric RecognitionBiometric Recognition
• Reduces fraud, enhance security, user convenience,..
• Multifactor authentication (card, PIN & biometric)
Bertillon SystemBertillon SystemBertillon system(1882) stored anthropomorphic features
H.T. F. Rhodes, Alphonse Bertillon: Father of Scientific Detection, Harrap, 1956
Friction Ridge PatternsFriction Ridge PatternsRidged (friction) skin on fingers, palms & soles
Cumins and Midlo, Finger Prints, Palms and Soles, Dover, 1961
FingerprintsFingerprints
“Perhaps the most beautiful and characteristic of all superficial marks (on human body) are the small furrows with the intervening ridges and their poresthat are disposed in a singularly complex yet even that are disposed in a singularly complex yet even order on the under surfaces of the hands and feet.”
Francis Galton, Nature, June 28, 1888
• Repeat Offenders: compare rolled inked
impressions (ten prints)
• Crime Scenes: compare latent prints with
forensic database
• First reported use of fingerprints in a
Fingerprints in ForensicsFingerprints in Forensics
• First reported use of fingerprints in a
criminal case was in Argentina (1895)
IAFIS: ~ 80 million 10 prints; ~80K searches/day;
automatic latent search is still very difficult
FBI Booking cardFBI Booking card
• Border security
• Multiple enrollments
• Financial fraud
• User convenience
Biometric: New EraBiometric: New Era
• User convenience
• Cheap & compact sensors
• Embedded systems
• Requirements: throughput, cost & HCI
Automatic Biometric RecognitionAutomatic Biometric Recognition
Enrollment vs. recognition; verification (1:1) vs. identification (1:N)
Smart Card
Physical Access Control
Logical Access Control
Border Control
Applications
Forensics
Consumer Products
ATM
Singapore Biometric PassportSingapore Biometric Passport
Fingerprint
Face
Started in August 2006
US-VISITUS-VISIT
~ 70M visitors have been processed at the borders
http://www.dhs.gov/usvisit/
People expelled from UAE make repeated efforts to
re-enter with new identities using forged documents
Border Crossing in UAEBorder Crossing in UAE
http://www.cl.cam.ac.uk/~jgd1000/UAEdeployment.pdf
Florida DMV found ~5,000 duplicates (multiple enrollments) by matching 700K face images against a database of 51M faces
Duplicate Driver LicenseDuplicate Driver License
Disney World, OrlandoDisney World, Orlando
Throughput: 100K/day, 365 days/ year; provides access to paying customers & denies access to non-paying customers
Meijer supermarket, Okemos Mobile phone transaction
Citibank, Singapore: pay by fingerprints Bank in Malawi uses fingerprints for micro-loans
Brazilian Elections: Voting MachinesBrazilian Elections: Voting Machines
• Voting machines with fingerprint ID
• TSE (Tribunal Superior Eleitoral) purchased 25,000
voting machines
• System will cover ~125 million Brazilian electors
http://idgnow.uol.com.br/seguranca/2006/08/30/idgnoticia.2006-08-29.2323285944/IDGNoticiaPrint_view
• Intrinsic failures
• Lack of uniqueness in biometric traits (large intra-class variability, small inter-user variability)
• Recognition error (FAR, FRR, failure to enroll)
• Adversary attacks
• Administrative/insider attacks (integrity of enrollment,
Biometric Systems: LimitationsBiometric Systems: Limitations
• Administrative/insider attacks (integrity of enrollment, collusion, coercion)
• Non-secure infrastructure (template security, channel security, software integrity)
• Biometric overtness (spoof attacks)
“State-of-the-art” Error Rates“State-of-the-art” Error Rates
Test Test ParameterFalse
Reject Rate False
Accept Rate
Fingerprint
FVC
[2006]
Heterogeneous population incl. manual workers and elderly people
2.2% 2.2%
FpVTE
[2003]
US govt. operational data
0.1% 1%
Controlled
25 25
FaceFRVT
[2006]
Controlled illumination,
high resolution
0.8%-1.6% 0.1%
IrisICE [2006]
Controlled illumination, broad quality range
1.1%-1.4% 0.1%
VoiceNIST
[2004]
Text independent, multi-lingual
5-10% 2-5%
~85M passengers at Atlanta airport in 2006; what is the acceptable error?
• Intrinsic failures
Biometric Systems: LimitationsBiometric Systems: Limitations
• Adversary attacks
Some ChallengesSome Challenges
• Matching latent friction ridge patterns
• Template security
• Fingerprint individuality
• Soft biometrics (Scars, Marks & Tattoos)
• Facial aging
• Facial Marks
• Sketch to photo matching
FingerprintsFingerprints
rolled plain latent
• Rolled/Plain to Rolled/Plain match
• Latent to Rolled/Plain match
Rolled/Plain Rolled/Plain MatchingMatchingNIST Fingerprint Vendor Technology Evaluation (FpVTE) 2003;
the best matcher (NEC) achieved 99.4% TAR at 0.01% FAR.
Challenges: low quality images, indexing, enhancing ”lights out” capability
Results are based on 10,000 flat fingerprints
Latent MatchingLatent Matching
Average rank-1 rate is ~60% (best ~80%) for
searching 100 latents against 10K rolled;
significantly lower than rolled/plain matching
NIST Evaluation of Latent Fingerprint Technologies (ELFT) 2007NIST Evaluation of Latent Fingerprint Technologies (ELFT) 2007
http://fingerprint.nist.gov/latent/elft07/phase1
Fingerprint Features Fingerprint Features
� Level 1: ridge orientation & frequency, singular point� Level 2: ridge, minutia� Level 3: incipient, dot, ridge contour, pore
Level 1 Level 2 Level 3
Ridge skeleton MinutiaeDelta CorePore Ridge contour
Correct Hits at RankCorrect Hits at Rank--11Rank-1 (rank-20) accuracy of matching 258 latents
against ~30K rolled is 74% (84%)
Matched minutiae shown in green;
index of matched minutiae in yellow;
unmatched minutiae shown in red
PalmprintsPalmprints~30% of crime scenes contain latent palmprints;
need for matching latents to full palmprints
Interdigital
Ridges
Distal transversecrease
ThenarHypothenar
Minutiae
Pores
Radial transversecrease
crease
Proximaltransversecrease
~1,000 minutiae in palmprint compared to ~100 in fingerprint
Latent with minutiae (Green: good quality)
100 latents matched to 10K full palmprints; rank-1
(20) accuracy is 69% (76%)
Latent Palmprint MatchingLatent Palmprint Matching
quality)
Corresponding full print Latent overlaid on full print
Template ProtectionTemplate Protection
• Myth: “A true biometric image cannot be created from master template..”• Template security
35 35
• Template security is critical because it is not easy to revoke templates like passwords
A. Ross, J. Shah and A. K. Jain, “From Templates to Images: Reconstructing Fingerprints from Minutiae Points”, IEEE Trans. on PAMI, Vol. 29, No. 4, pp. 544-560, April 2007
Are Fingerprints Unique?Are Fingerprints Unique?
• “Only Once during the Existence of Our Solar System
Will two Human Beings Be Born with Similar Finger
Markings.” Harper's headline, 1910
• "Two Like Fingerprints Would be Found Only Once
Every 1048 Years." Scientific American, 1911
• The uniqueness of fingerprints has been accepted over • The uniqueness of fingerprints has been accepted over
time due to lack of contradiction & relentless repetition
• Daubert ruling (1993): Hypothesis testing, known or
potential error rate; standards exist and maintained;
Peer reviewed and publications; general acceptance
• USA v. Byron Mitchell (1999)
Tattoo Tattoo Matching & RetrievalMatching & Retrieval
Retrieval ExamplesRetrieval ExamplesQuery Top-5 Retrieved Images with match scores
105
6
6
6
6
Query 1
6
Query 2 79 7324 22
16
How do we scale this to databases with millions of images?
Face RecognitionFace Recognition
1959
1960
?
1973
1972
Challenges in Face RecognitionChallenges in Face Recognition
Pose, lighting, expression
Occlusion
AgingSketch vs. photo
Age ModelingAge ModelingPhotographs of 4 sisters taken every year from 1975 to 2007
1975(age: 23, 15, 25, 21)
1976(age: 24, 16, 26, 22)
Nixon and Galassi, The Brown Sisters, Thirty-three Years, 2007, The Museum of Modern Art
(age: 24, 16, 26, 22)
2007(age: 56, 48, 58, 54)
Rank-one accuracy of Cognitec improved from 15.6% to 27.1%
Recognition with Facial MarksRecognition with Facial Marks
⊗Score fusion
≠ =
≠ =
Recognition failed at rank-1 (FaceVACS only)
Recognition succeeded at rank-1 (FaceVACS + face marks)
Matching with face marks
≠ =
Sketch to Photo MatchingSketch to Photo Matching
• Search a mug shot database for a sketch drawn by a
forensics artist based on witness/victim description
Mug-Shot
Matching
Forensic Artist Sketch
3D sketch Sketch-to-photo conversio
n
Score:0.01
Matching
Score:0.16
Images at different view-
points
Video Surveillance TrialVideo Surveillance TrialMainz Railway StationMainz Railway Station
• Performed by German Federal Police (Oct, 06 to Jan 07)
• Purpose: Test Face recognition systems in a real environment
of a train station; camera views at escalator & stairs
• Performance: Identification rate of 60% at a FAR of 0.1%
based on a gallery (watch list) of 200 enrolled persons
44
Privacy ConcernsPrivacy Concerns
• Will biometric be used to track people?
• Will biometric be used only for the intended purpose? Will the
databases be “linked”? (Function creep)
• How do we alleviate these concerns?
45
SummarySummary
• Biometric recognition provides a strong method
of linking persons to identity records
• With over 100 years of use in forensics,
biometrics is now permeating our society
• Like any security system, biometric systems
can fail and be circumvented; what are its can fail and be circumvented; what are its
implications on citizens?
• Biometrics is not a fully solved problem: ROI,
sensors, representation, robust matcher, fusion
of multiple traits, system security, privacy,
match on card, identification at a distance….
New Biometric Traits?New Biometric Traits?